MEV-Boost relay equivocation / unbundling — Ethereum mainnet — 2023-04-03

Summary

Ethereum mainnet runs an out-of-protocol Proposer–Builder Separation (PBS) layer called MEV-Boost. Block builders construct execution payloads and submit them to relay servers; relays hold the payload in escrow and present a header-only summary to the validator (proposer) for the slot; the proposer signs the blinded header (SignedBlindedBeaconBlock); the relay releases the unblinded block body to the network only after the proposer's signature has been published. The escrow guarantee — body-only-after-publication — is the relay's defining role.

On 2023-04-03 at Ethereum mainnet slot 6137846, a malicious validator broke that escrow guarantee in the proposer-to-relay direction. The validator submitted a signed-but-invalid SignedBlindedBeaconBlock to the Flashbots mev-boost-relay (the implementation also operated by Aestus, Bloxroute, Eden, BloXroute Max-Profit, Manifold, and others in operationally similar variants). The relay's PublishBlock() path validated the proposer's signature on the header and returned the unblinded block body via getPayload even though the block was not canonicalised. The validator then proposed a different block to the network in the same slot — a block whose transaction ordering re-configured the sandwich-MEV bundles in the revealed body into a back-run-only configuration, capturing the value the original sandwich operators had constructed their bundles to extract. ~$25M flowed from five sandwich operators to the attacker validator in a single slot.

The proximate cause — per the Flashbots, Aestus, and Bloxroute post-mortems, BlockSec's technical reconstruction, and Paradigm's timing-and-ordering analysis, all converging on the same root-cause description — is the relay-side gap between proposer-signature validity and block canonicalisation. The relay's release path treated a valid proposer signature as sufficient to release the body; it did not require the released block to be the one actually canonicalised by the network. The canonical patch — applied to Flashbots mev-boost-relay and adopted across the major implementations within days of the incident — gates body release on successful network publication of the relay's specific block hash and adds a slot-bound timing guard on getPayload. A separate equivocation-strategy class (in which a proposer who has called getPayload early can publish a different block while still receiving the relay-released body) was disclosed and mitigated through coordinated relay updates in the same window [flashbotsequivocation2023] [chainlightpbs2023].

The U.S. DOJ indicted Anton and James Peraire-Bueno in May 2024 for the operation [dojmevbros2024]. The indictment cites the brothers' construction of the validator setup, their signed-but-invalid SignedBlindedBeaconBlock submission, their re-ordered competing block proposal, and the laundering of the proceeds. The case proceeded through 2024 and into 2025 with a subsequent mistrial reported (per the citation note); the indictment remains the canonical named-individual attribution at v0.1 freeze. T14.002 is the rare T14 Technique with confirmed-by-court attribution; the case is OAK's canonical reference for that property under T14.

For OAK's purposes the incident is a clean T14.002 sub-pattern (a) extraction with confirmed-by-court attribution. The novel OAK contribution of the worked example is not the bug class — that is exhaustively documented across the cited Flashbots / Bloxroute / BlockSec / Paradigm / ChainLight / Aestus literature — but the structural framing for OAK-T14: the relay-code escrow guarantee is a load-bearing property whose absence (or violation) is the structural prerequisite for sub-pattern (a), and the cohort-level mitigation surface (relay diversification + neutrality selection at the validator side, in-protocol PBS at the protocol-research level) is the canonical T14.002 defender response.

Timeline (UTC)

When	Event	OAK ref
2020-12	Ethereum Beacon Chain genesis; PoS validator economics established; slashing penalties calibrated to a security baseline that pre-dates the MEV-economics scale	(T14 baseline)
2022-09	Ethereum mainnet Merge; MEV-Boost out-of-protocol PBS layer becomes the dominant block-production path; Flashbots mev-boost-relay is the reference implementation, with operationally-similar variants from Aestus, Bloxroute, Eden, BloXroute Max-Profit, Manifold	(T14.002 surface emerges)
2023-04-03 (slot 6137846)	Attack — Malicious validator submits signed-but-invalid SignedBlindedBeaconBlock to Flashbots mev-boost-relay; relay's PublishBlock() path validates proposer signature and releases unblinded body via getPayload; validator proposes a different block in the same slot with re-ordered transactions; ~$25M extracted from five sandwich-MEV operators including the operator profiled as "jaredfromsubway.eth"	T14.002 sub-pattern (a) extraction
2023-04-04 to 2023-04-06	Flashbots, Aestus, Bloxroute ship five patches to mev-boost / mev-boost-relay: publication-gated body-release path, slot-bound timing guard, additional equivocation-strategy mitigations; brief network-instability window with elevated reorgs follows on 2023-04-06	(relay-codebase mitigation)
2023-04-21	Public disclosure of the operation; attacker self-styling as "low-carb-crusader" / "sandwich the ripper" surfaces; sandwich-operator victim cohort identified including "jaredfromsubway.eth" [eigenphijared2023]	(forensic attribution begins)
2023-04	Flashbots post-mortem published [flashbotsmevboost2023]; Bloxroute post-incident communication [bloxroutemevboost2023]; BlockSec technical reconstruction [blocksecmevboost2023]; Paradigm timing-and-ordering analysis [paradigmpbstime2023]	(cohort transparency signal)
2023-04 to 2023-05	Flashbots disclosure of the equivocation-strategy class with early getPayload calls [flashbotsequivocation2023]; ChainLight publishes "PBS Reward Design Vulnerability and MEV-boost Equivocation Attack Research" [chainlightpbs2023]	(cohort vulnerability re-confirmed)
2023-04 to 2024	Cohort-level relay diversification recommendations spread; neutrality-only relays (Aestus, Ultra Sound, Agnostic Gnosis at various points) explicitly position against vertical integration [aestusverticalintegration2023]; MEV Watch dashboard operationalises per-relay censorship monitoring [mevwatch2024]	(T14.002 sub-pattern (b)/(d) cohort surface continues)
2024-05	U.S. DOJ indicts Anton and James Peraire-Bueno for the April 2023 MEV-Boost timing exploit; ~$25M loss cited; charges include wire fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering [dojmevbros2024]	T14.002 confirmed-by-court attribution
2024 to 2025	Case proceeds; subsequent mistrial reported (per citation note); the indictment remains the canonical named-individual attribution document at v0.1 freeze	(legal proceedings)
Continuing	In-protocol PBS (ePBS, EIP-7732 and successor proposals) progresses as the structural cure that retires T14.002 as a Technique class; every mev-boost-relay patch between 2023-04 and v0.1 is a containment, not a cure	(T14.002 retirement path)

What defenders observed

• The relay-code escrow guarantee was the single load-bearing property and the patch surface was relay-internal. The Flashbots, Aestus, and Bloxroute post-mortems all framed the relay codebase change as the load-bearing mitigation [flashbotsmevboost2023] [bloxroutemevboost2023]. The patch was a publication-gated body-release path: the relay does not release the body unless the published block is the relay's body, with a slot-bound timing guard on getPayload. The defender lesson is that the escrow guarantee is enforced by relay-codebase logic, not by the Ethereum protocol — and that the validator-side mitigation (relay diversification, neutrality selection) is a per-operator choice that is not enforced by the protocol.
• The economic asymmetry between MEV-per-block and slashing-penalty was the structural prerequisite for sub-pattern (a) and remains so. The attacker validator's slashing exposure was in the low-thousands-of-dollars range against ~$25M of extracted value [a16zslashingecon]. The academic literature had formalised this asymmetry in advance — Neuder et al. on PoS attacks [neuder2021posattacks], a16z's slashing-economics analysis [a16zslashingecon] — and the April 3rd 2023 incident is the empirical anchor that the formalisation captures real economic conditions, not a hypothetical edge case. The defender lesson: chain designers sizing slashing penalties to dominate the MEV reward of the corresponding misbehaviour is a structural mitigation; relying on slashing as a deterrent for sub-pattern (a) without that calibration is not.
• Cohort-level relay diversification was operationally available as a per-validator mitigation, but adoption was uneven. Validators connected only to a single relay with a single point of trust were the structural prerequisite for sub-pattern (a). Post-incident, the cohort-level recommendation was relay diversification across non-censoring, non-vertically-integrated relays (Aestus, Ultra Sound, Agnostic Gnosis at various points, Flashbots-post-patch) [aestusverticalintegration2023]. The defender lesson: relay diversification is a per-operator choice with operational cost (more relay endpoints to monitor, more bid-stream complexity) but is the load-bearing per-validator T14.002 mitigation at v0.1. Validators operating a single-relay configuration in 2025–2026 are still on a standing T14.002 sub-pattern (a) surface, even though the canonical 2023 bug is patched, because future relay-code defects in the patched implementations remain a possibility and the diversification posture is the structural defence.
• The confirmed-by-court attribution was the rare outcome at the T14 layer and the realistic ceiling for the case. The U.S. DOJ indictment of the Peraire-Bueno brothers [dojmevbros2024] is one of the few T14 attribution events that converted on-chain forensic analysis into a named-individual claim. Most T14 incidents — including the operational mass-slashing event tied to SSV-Network operator infrastructure on 2025-09 [coindeskssv2025], the Cosmos-SDK ASA-2024-005 slashing-evasion class [cosmosasa2024005], and the EigenLayer mainnet slashing-enabled cohort [eigenlabsslashinglive2025] — remain at the operational-or-design level without indictment-class attribution. The defender lesson: confirmed-by-court attribution at T14 is achievable but rare, and contributors writing future T14 worked examples should not require it as a precondition for cataloguing.
• The companion victim-side cohort framing is at /examples/2023-02-jaredfromsubway-mev.md. The five sandwich-MEV operators victimised in the April 3rd 2023 incident include the operator profiled as "jaredfromsubway.eth"; the EigenPhi operator profile [eigenphijared2023] is the canonical companion reference for the victim-side cohort framing. T14.002 is the relay-attack surface; the victim-side framing — sandwich-MEV operators whose bundles were unbundled — sits separately under a T13.002 (Bundler MEV) / T14.002 / OAK-EOA-MEV-operator joint frame and the per-operator cohort profile is the canonical reference.

What this example tells contributors writing future Technique pages

• T14.002 is rated stable because the canonical incident is exhaustively documented, but the surface is steady-state. The April 3rd 2023 patch is shipped and adopted across the major implementations, but sub-patterns (b) censoring relay, (c) relay-data exfiltration, and (d) relay–builder vertical collusion are operating now, in production, at the cohort level, and the validator-side mitigation (relay diversification + neutrality selection) is a per-operator choice that is not enforced by the protocol. T14.002 should be re-rated only when in-protocol PBS lands on mainnet. Contributors writing future T14.002 worked examples should preserve this distinction: a 2026 worked example of sub-pattern (b) or (d) is not a "post-mitigation surprise" — it is the steady-state surface T14.002 has always covered, and the documentation should treat it as such.
• The economic-asymmetry framing belongs in T14 mitigations, not just in T14.001. The slashing-vs-MEV gap that enabled sub-pattern (a) at the April 3rd 2023 incident is a chain-economic-design property, not a relay-code property — and it generalises across T14.001 (slashing-condition exploit) and T14.002 (MEV-boost relay attack) and T14.003 (restaking cascading risk). Contributors writing the T14 Mitigations layer should treat economic-asymmetry calibration as a cross-Technique mitigation surface that the April 3rd 2023 incident anchors empirically.
• The confirmed-by-court attribution at T14.002 is OAK's anchor for the "is on-chain attribution achievable" question. Contributors writing future T14 worked examples should reference this case when discussing the realistic attribution ceiling for T14 incidents — and should not over-claim attribution simply because the on-chain forensics are detailed. The Peraire-Bueno indictment was achievable because the operation involved a specific U.S.-jurisdictional validator setup, traceable funding, and a sandwich-victim cohort with the resources to engage forensics support; most T14 incidents do not have those properties.
• In-protocol PBS is the structural cure and the T14.002 retirement path. Contributors writing future T14.002 entries should treat ePBS / EIP-7732 family proposals as the structural cure that retires T14.002 as a Technique class. Until in-protocol PBS lands on mainnet, T14.002 remains a steady-state surface with sub-patterns (b)/(c)/(d) operating in production and sub-pattern (a) returnable on any future relay-code defect.

Public references

• [flashbotsmevboost2023] — Flashbots post-mortem of the April 3rd 2023 incident and shipped mitigations; canonical post-incident document.
• [bloxroutemevboost2023] — Bloxroute relay post-incident communication.
• [blocksecmevboost2023] — BlockSec technical reconstruction of the unbundling exploit path.
• [paradigmpbstime2023] — Paradigm: timing, slots, and the ordering of events under MEV-Boost.
• [flashbotsequivocation2023] — Flashbots disclosure of the separate equivocation-strategy class with early getPayload calls.
• [chainlightpbs2023] — ChainLight: "Patch Thursday — PBS Reward Design Vulnerability and MEV-boost Equivocation Attack Research".
• [dojmevbros2024] — U.S. Department of Justice, "Two Brothers Arrested for Attacking Ethereum Blockchain and Stealing $25M in Cryptocurrency" (May 2024); canonical confirmed-by-court attribution document; mistrial subsequently reported per citation note.
• [mevwatch2024] — MEV Watch per-relay censorship dashboard; cohort signal for sub-pattern (b).
• [aestusverticalintegration2023] — Aestus on relay–builder vertical integration as neutrality concern; cohort signal for sub-pattern (d).
• [eigenphijared2023] — EigenPhi operator profile of "jaredfromsubway.eth"; canonical companion reference for the victim-side sandwich-MEV cohort framing.
• [neuder2021posattacks] — Neuder et al., academic analysis of three attacks on PoS Ethereum, including slashable-misbehaviour cost calculations against MEV rewards.
• [a16zslashingecon] — a16z crypto, "The cryptoeconomics of slashing"; characterises slashing-vs-MEV deterrent gap with worked dollar-loss examples.
• [daian2019flashboys] — foundational MEV characterisation; the economic primitive T14.002 inherits.

Discussion

The April 3rd 2023 MEV-Boost relay equivocation / unbundling incident is OAK's canonical T14.002 worked example and the rare T14 case with confirmed-by-court attribution at v0.1 freeze. It anchors the T14 (Validator / Staking / Restaking Attacks) Tactic at the consensus-layer-adjacent off-protocol PBS layer, distinct from T14.001 (slashing-condition exploit, where the dominant observed failure mode is operational rather than adversarial) and T14.003 (restaking cascading risk, where the dominant evidence is design-review and risk-analysis literature rather than a flagship cascade event). T14.002 is the T14 Technique with the densest forensic record at v0.1 — a single canonical incident, exhaustive multi-vendor post-mortems, a confirmed-by-court attribution, and a continuously-instrumented cohort surface for sub-patterns (b)/(c)/(d).

The cohort framing for OAK matters in two ways. First, the April 3rd 2023 incident is the worked evidence that the relay-code escrow guarantee is load-bearing — and that the cohort-level mitigation surface (relay diversification + neutrality selection at the validator side, in-protocol PBS at the protocol-research level) is the canonical T14.002 defender response. Second, the economic asymmetry between MEV-per-block and slashing-penalty that enabled sub-pattern (a) generalises across T14 — the slashing-vs-MEV gap is a chain-economic-design property whose calibration is a cross-Technique T14 mitigation surface, and the April 3rd 2023 incident anchors that calibration empirically.

For OAK's broader credibility, including the April 3rd 2023 case as the lead T14 worked example closes a gap: T14 is a first-class Tactic at v0.1 freeze with three Techniques but, prior to this example, the live worked-example anchor in the examples/ corpus was thin relative to T9 / T10 / T11. The April 3rd 2023 incident provides T14 with a confirmed-by-court attribution anchor, a multi-vendor post-mortem cohort, and a structural-cure-vs-containment narrative (in-protocol PBS as the retirement path) that contributors writing future T14 worked examples (T14.001 adversarial slashing, T14.003 restaking cascade) can use as a tone-and-structure precedent.

T14.002 should be re-rated only when in-protocol PBS lands on mainnet. Until then, the April 3rd 2023 incident is the canonical sub-pattern (a) anchor and the cohort sub-patterns (b)/(c)/(d) remain operational, instrumented, and structurally unaddressed by the off-protocol PBS layer the relay sits in.